---
title: "Microsoft 365 Safe Links: Advanced Threat Protection"
canonical: "https://kb.uconn.edu/space/IKB/10730111028/Microsoft%20365%20Safe%20Links%3A%20Advanced%20Threat%20Protection"
format: markdown
---
Links in incoming emails are processed by Office 365 Advanced Threat Protection (ATP). ATP helps scan for malicious and suspicious content , thereby providing better spam and malware protection for email and other Office 365 services. The links are scanned in real time, thereby determining if it is a phishing link that contains harmful data. All links that has been scanned is rewritten into a URL that is in the format  '[https://na01.safelinks.protection.outlook.com/](https://na01.safelinks.protection.outlook.com/)'.  

## Safe Links Identification

When the URL is hovered over in the email, it will display the original URL. But once clicked through it will route to the new rewritten ATP URL. In Google Workspace, the rewritten link can be visible in the bottom left corner of the browser once hovered.  Please note that, in plain text emails, the rewritten longer URL will be displayed as a three to four line URL in the body of the email. Hence, it is essential to use HTML format to send emails so that the original URL can be seen instead of the rewritten URL.

If the URL is not identified as suspicious, it will seamlessly redirect you to the original destination URL.

Please note that links and hyperlinks in emails should always be treated with caution especially in the case where you are asked to provide any sensitive information like a username or password.

![screenshot of an email with an attached hyperlink](media://3b3c5d36-434a-496f-89a0-cea7b5f61e5e)

Once the URL is clicked, it will redirect to an ATP link as shown below and then proceed to the URL if it is determined as safe:

> ℹ️ nam10.safelinks.protection.outlook.com/***URL ***(the URL that was clicked will appear after the slash)

> 📝 If you receive a plain-text email, you will see the rewritten URL directly in the message body. You can use a [URL decoder](https://uconn.atlassian.net/wiki/spaces/IKB/pages/10803643182) to convert it to the original URL.

  
Unsafe Links Identification

If the URL is scanned and detected as unsafe, the redirected URL will proceed to the block page as shown below.

![screenshot showing the following message This website has been classified as malicious](media://c4f67ebb-15f1-495c-9cc5-4baa3a0addb8)

## Safe and Unsafe Attachments

All attachments going through Office365 will be scanned for malware by ATP. If ATP suspects the attachment contains malware, it will still deliver the message but block the attachment.

If an attachment is identified as malicious when scanned, the following message will show:

“Outlook blocked access to the following potentially unsafe attachments:” ***Attachment Name***

![screenshot of the notification that appears when an attachment has been detected as unsafe](media://3ca499c5-62ba-4a4b-a531-1d46d7307c2f)

## Related Articles

> Macro (contentbylabel)